Lynette T. Stevenson, owner of DALS Credit Solutions Co., opposes the proposed FAR overhaul because it fails to adequately analyze the specific burdens it places on individually owned small businesses without in-house legal or compliance staff. She argues that the rule violates the Regulatory Flexibility Act by ignoring the professional skills required for compliance and advocates for keeping competition-affecting requirements in binding FAR text rather than non-regulatory guidance.

The commenter, representing a business entity, argues that the proposed requirement for contractors to report unmarked or mismarked CUI within 8 hours shifts the responsibility of classification from the government to the private sector. They advocate for a revision that ensures the government remains solely responsible for identifying and marking CUI, allowing contractors to rely on government-provided designations.

Shawn Bilak of Bilak Security Solutions, LLC, expresses support for the FAR Council's efforts to simplify and standardize acquisition requirements, particularly regarding the proposed CUI framework and the creation of Standard Form XXX. The commenter provides specific recommendations to ensure the new rules provide clear, contract-specific guidance on CUI identification, incident reporting timelines, cloud service usage, and subcontractor flowdowns to improve contractor compliance and assessment readiness.

The commenter argues that the proposed FAR Rule creates a regulatory conflict by requiring safeguarding controls for unclassified non-CUI information, which is explicitly prohibited by 32 CFR 2002.1(c). They request that the government resolve this disconnect by either revising the CUI regulation or removing the non-compliant safeguarding requirements from the FAR.